Samsung SLocation Improper Access Control Vulnerability Allowing Execution of Privileged APIs

A vulnerability exists in the SLocation component of Samsung devices running Android versions 15 and 16, prior to the January 2026 Security Maintenance Release. This vulnerability allows local attackers to execute privileged APIs due to improper access control. The issue has been privately disclosed and the January 2026 SMR includes a patch that addresses this vulnerability by implementing proper access control.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of privileged APIs, potentially allowing local attackers to manipulate system functions or access restricted data.

Remediation

Users can update to the January 2026 Security Maintenance Release to address this vulnerability. This update includes the necessary patch for the improper access control issue in SLocation.